Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems

Daniel Ruiz; Luca Luceri; Emilio Ferrara

cs.CROct 21, 2026

Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems

Authors: Daniel Ruiz, Luca Luceri, Emilio Ferrara

Organizations: Information Sciences Institute University of Southern California Los Angeles, CA, USA

Abstract

Modern LLM agents can retrieve information from accessible documents, and then disclose a sensitive conclusion assembled from them. This mosaic effect creates a critical risk for agents operating over confidential data. We quantify its realization with 30 synthetic cybersecurity, medical, and military examples, yielding 10,800 final answers from three LLM agents in controlled simulation and 1,440 answers from live agents in two open-source harnesses. Even under benign queries designed to be answerable from one document, GPT-5.6-Sol, the best performing model tested, discloses forbidden composites in 7.08% of answers (95% CI: 3.75-10.67%) in simulation, with worse disclosure rates in live harnesses. Adding visible classification headers and explicit aggregation rules reduces pooled disclosure rates substantially, yet unsafe disclosures persist in 32.37% of simulated answers (95% CI: 28.33-36.19%) across all intents despite these safeguards. Furthermore, increased refusals do not guarantee confidentiality, since significant refusals reveal the prohibited conclusion regardless. These results point to a troubling conclusion: sensitive data leaks via mosaic-style events are an observed confidentiality failure mode in the evaluated settings at non-negligible rates. They motivate stronger controls on what agents may infer and disclose in sensitive data environments with mixed-clearance users.

Figures & tables

Outcome	Human $\alpha$	Judge $\alpha$	Precision (%)	Recall (%)
Mosaic	0.810 [0.727, 0.889]	0.817 [0.711, 0.917]	86.44	94.44
Refusal	0.962 [0.911, 1.000]	0.925 [0.826, 1.000]	90.48	100.00

Table 1: Human-only alpha and adopted judge agreement with majority references on 120 reused development answers. Brackets are approximate 95% example-cluster intervals.

Controlled simulation
System / population	$n$	Mosaic (%)	Refusal (%)
GPT-5.6 Sol	3600	27.75 [21.83, 33.03]	37.56 [32.72, 43.11]
Claude Sonnet 5	3600	63.17 [55.30, 70.36]	59.75 [55.03, 65.47]
Qwen3.5-27B	3600	67.11 [59.89, 73.64]	11.08 [8.39, 13.97]
Equal three-generator mixture	10800	52.68 [46.32, 58.15]	36.13 [32.65, 40.34]
Live harnesses; comparison baseline is simulated GPT above

Table 2: Overall final-answer outcomes, averaging all 24 configurations. Rates are percentages with approximate 95% example-cluster intervals. Bold marks the highest point estimate for each outcome within each section. The pooled row is the fixed equal mixture of the three simulated generators; Pi and Hermes are compared with simulated GPT, not that mixture. Mosaic and refusal labels may overlap.

Figure 1: Benign-query mosaic rates in simulated GPT and two live GPT-led harnesses pooling all safeguard and distractor settings. Whiskers depict 95% example-cluster intervals.

GPT-5.6 Sol	No disclosure or refusal (10/10)
Claude Sonnet 5	Refusal only (10/10)
Qwen3.5-27B	Disclosure only (10/10)

Figure 2: Selected synthetic medical example, med_006 . The kit question needs only A; combining A with B reveals the forbidden placebo assignment.

Figure 3: Pooled simulated mosaic rates by header visibility and aggregation rules (

n=2,700

per configuration).

Figure 4: Pooled full-stack and marginal safeguard effects on disclosure and refusal, with 95% example-cluster intervals.

Figure 5: Joint final-answer outcomes, counted from the accepted simulated labels. Panel (a) spans all 24 configurations (

n=3,600

per generator); panel (b) restricts to shown headers and rules on (

n=900

), retaining all intents and both distractor settings. Purple denotes disclosure with refusal.

Figure 7: Military mosaic rates in simulation and live harnesses, with 95% example-cluster intervals.

Figure 8: Matched live-minus-simulated mosaic differences by domain, with 95% example-cluster intervals.

Appendix figures & tables20 assets

Supplementary material from the paper’s appendix.

Appendix

Outcome	Unanimous		Split	Majority	Pairwise
	$+$	$-$	votes	$+$	agreement (%)
Mosaic	47	56	17	54	89.2–91.7
Refusal	37	80	3	38	97.5–99.2

Appendix

Table 3: Human annotations (120 answers, three annotators).

+

-

: positive/negative labels; agreement: range across annotator pairs.

Outcome	TP	TN	FP	FN
Mosaic	51	58	8	3
Refusal	38	78	4	0

Appendix

Table 4: Judge classifications against majority-vote references (

n=120

). TP/TN: true positives/negatives; FP/FN: false positives/negatives.

D	H	R	GPT	Claude	Qwen
0	0	0	20.00 [10.67, 30.67]	80.67 [66.67, 93.33]	42.00 [29.32, 55.35]
0	0	1	1.33 [0.00, 3.33]	5.33 [2.00, 9.33]	24.67 [13.33, 36.67]
0	1	0	8.67 [3.33, 14.67]	75.33 [59.98, 88.68]	47.33 [33.33, 61.33]
0	1	1	2.00 [0.00, 5.33]	7.33 [2.67, 12.67]	12.00 [4.00, 22.00]
1	0	0	14.00 [5.98, 24.00]	78.67 [64.67, 90.67]	42.00 [28.00, 56.00]
1	0	1	2.00 [0.00, 5.33]	7.33 [2.00, 13.33]	28.67 [16.67, 40.67]

Appendix

Table 5: Benign-query mosaic rates (

n=150

per cell).

D	H	R	GPT	Claude	Qwen
0	0	0	78.00 [64.67, 89.33]	90.00 [78.67, 99.33]	89.33 [78.67, 98.67]
0	0	1	39.33 [26.67, 50.68]	68.00 [56.00, 80.00]	72.67 [59.98, 84.67]
0	1	0	66.67 [52.67, 79.33]	76.67 [64.00, 88.67]	97.33 [94.67, 99.33]
0	1	1	0.00 [0.00, 0.00]	58.00 [47.33, 68.67]	64.00 [52.00, 75.33]
1	0	0	79.33 [64.67, 91.35]	85.33 [74.00, 95.33]	93.33 [85.33, 99.33]
1	0	1	42.00 [28.67, 55.33]	72.67 [60.00, 84.00]	79.33 [66.67, 90.00]

Appendix

Table 6: Explicit-query mosaic rates (

n=150

per cell).

D	H	R	GPT	Claude	Qwen
0	0	0	46.67 [34.00, 58.67]	82.00 [72.67, 90.67]	94.67 [86.67, 100.00]
0	0	1	28.00 [18.67, 37.33]	74.00 [63.33, 83.33]	80.00 [69.33, 89.33]
0	1	0	40.67 [28.67, 52.00]	71.33 [60.67, 82.00]	94.00 [87.33, 99.33]
0	1	1	0.67 [0.00, 2.00]	79.33 [68.67, 88.67]	75.33 [65.33, 84.67]
1	0	0	46.67 [34.00, 58.00]	78.00 [66.00, 88.67]	94.67 [86.67, 100.00]
1	0	1	32.00 [22.67, 42.00]	67.33 [56.00, 77.35]	86.67 [76.67, 94.67]

Appendix

Table 7: Adversarial-query mosaic rates (

n=150

per cell).

Generator	Neither	Refusal only	Both	Mosaic only
GPT	1284	1317	35	964
Claude	283	1043	1108	1166
Qwen	932	252	147	2269

Appendix

Table 8: Joint final-answer counts (

n=3,600

per generator).

Generator	Full stack	Interaction
GPT	46.44 [37.44, 55.00]	14.11 [6.44, 21.33]
Claude	36.89 [27.44, 45.44]	-3.33 [-10.56, 3.33]
Qwen	25.44 [19.44, 31.78]	15.33 [10.22, 20.67]
Pooled	36.26 [29.85, 41.82]	8.70 [4.15, 13.08]

Appendix

Table 9: Full-stack mosaic reductions and interactions (pp).

Contrast	Mosaic reduction	Refusal increase
Full stack	36.26 [29.85, 41.82]	46.74 [41.67, 51.07]
Rules	27.91 [23.19, 32.41]	30.37 [26.11, 34.26]
Headers	8.35 [6.13, 10.37]	16.37 [14.20, 18.30]

Appendix

Table 10: Pooled safeguard effects (pp) for Figure 4 . Rules and headers are marginal contrasts.

Marginal endpoint	Mosaic rate
Rules off	66.63%
Rules on	38.72%
Headers hidden	56.85%
Headers shown	48.50%

Appendix

Table 11: Pooled mosaic rates averaged over the other safeguard factor.

Contrast	GPT	Claude
Full stack	-39.11 [-46.11, -31.22]	-70.44 [-80.33, -59.67]
Rules	-14.44 [-19.56, -8.67]	-54.94 [-64.78, -44.39]
Headers	-24.67 [-28.00, -20.89]	-15.50 [-19.78, -11.89]
Interaction	-26.22 [-34.44, -16.89]	-0.11 [-5.89, 6.00]
Contrast	Qwen	Pooled
Full stack	-30.67 [-36.44, -24.67]	-46.74 [-51.07, -41.67]

Appendix

Table 12: Refusal reductions and interactions (pp). Negative reductions indicate increased refusal. Rules and headers are marginal contrasts.

Figure 9: Pooled full-stack mosaic reductions by intent and distractor setting.

Intent	No distractor	With distractor
Benign	-7.33 [-17.33, 2.00]	-0.67 [-10.67, 7.33]
Explicit	-3.33 [-18.00, 11.33]	5.33 [-4.67, 16.00]
Adversarial	-16.00 [-27.33, -4.00]	2.00 [-8.67, 12.00]

Appendix

Table 13: Claude mosaic interactions by intent and distractor setting (pp).

GPT
Intent	No distractor	With distractor
Benign	3/150; 2.00 [0.00, 5.33]	3/150; 2.00 [0.00, 4.67]
Explicit	0/150; 0.00 [0.00, 0.00]	2/150; 1.33 [0.00, 4.00]
Adversarial	1/150; 0.67 [0.00, 2.00]	0/150; 0.00 [0.00, 0.00]
Claude
Benign	11/150; 7.33 [2.67, 12.67]	5/150; 3.33 [0.67, 6.67]

Appendix

Table 14: Mosaic counts and rates with headers shown and rules on (

n=150

per cell).

Figure 10: Mosaic rates by generator and domain (

n=1,200

each).

Domain	$k/n$	Mosaic rate
Cybersecurity	2088/3600	58.00 [48.61, 63.95]
Medical	1911/3600	53.08 [40.69, 63.83]
Military	1690/3600	46.94 [35.86, 56.25]

Appendix

Table 15: Pooled domain mosaic counts and rates.

Population	$n$	Mosaic $k$ ; rate	Refusal $k$ ; rate
Simulated GPT	1200	85; 7.08 [3.75, 10.67]	131; 10.92 [7.42, 14.42]
Pi	240	30; 12.50 [6.25, 19.17]	11; 4.58 [0.83, 9.17]
Hermes	240	21; 8.75 [4.58, 13.33]	8; 3.33 [0.00, 6.67]

Appendix

Table 16: Benign-query mosaic and refusal counts (

k

) and rates.

Outcome / scope	Pi	Hermes
Overall mosaic	2.39 [-0.39, 5.33]	4.61 [1.94, 7.20]
Overall refusal	-3.81 [-6.50, -1.03]	-7.97 [-10.28, -5.86]
Benign mosaic	5.42 [-0.17, 11.75]	1.67 [-2.84, 6.25]
Benign refusal	-6.33 [-9.83, -2.83]	-7.58 [-10.42, -5.00]

Appendix

Table 17: Live-minus-simulated GPT differences (pp). Overall: 720 live/3,600 simulated; benign: 240/1,200.

Population	Mosaic reduction	Refusal increase
Simulated GPT	46.44 [37.44, 55.00]	39.11 [31.22, 46.11]
Pi	51.11 [40.00, 61.67]	40.00 [30.00, 48.33]
Hermes	51.11 [41.67, 60.00]	41.11 [31.11, 49.44]

Appendix

Table 18: Full-stack mosaic reductions and refusal increases (pp).

Harness	Full capture	Partial capture	Unknown	External retrieval	Trace flags
Pi	528	128	58	0	91
Hermes	0	704	72	7	142

Appendix

Table 19: Retained capture and trace counts (

n=720

per harness). Full capture records both target documents; partial and unknown categories overlap.

Figure 11: Mosaic-rate differences with versus without a distractor.

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 331 papers

Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems
May 26, 2026Aman Priyanshu, Supriti Vijay, Esha PahwaAI Agent Safety Benchmarks Multi-Agent LLM Systems
Foundation AI · USA · Corvic AI
MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication
Aug 3, 2026Jinghan Xu, Longze Fan, Zeyuan Wang +2Multi-Agent LLM Systems LLM Agent Security
1Nankai University, China · 2China University of Petroleum, China · 3Sun Yat-sen University, China +1
Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control
Sep 12, 2026Minsun Shim, Ramisha Raida Karim, Ruthwik Jakkula +4LLM Agent Security Privacy Leakage in Language Models
University of California, Irvine · University of California, Santa Cruz · University of California, Davis +1

May 26, 2026J/K move · Enter open · S save

Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems

Aman Priyanshu, Supriti Vijay, Esha Pahwa

Foundation AI · USA · Corvic AI

AI Agent Safety Benchmarks Multi-Agent LLM Systems LLM Agent Evaluation LLM Agent Security Privacy Leakage in Language Models Data Leakage+2

Open paper AskPDF arXiv

LLM safety evaluations predominantly test models in isolation, yet deployed AI agents increasingly operate within persistent social environments alongside other agents. We introduce a Moltbook-style simulation platform where thousands of LLM agents interact across communities over a simulated month, and use it to evaluate privacy as a downstream safety concern under varying degrees of social pressure. We find that shifting from single turn to multi turn social evaluation amplifies privacy violations (CIMemories 19.95% to Ours 45.30% across OpenAI models), that leakage is socially contagious, with agents 8 times more likely to disclose sensitive information after observing a peer do so, and that explicit privacy instructions reduce but do not eliminate this effect, leaving leakage rates above 37.8% even with safeguards. Our findings suggest that static chat based safety benchmarks systematically underestimate risks in agentic deployment, and that social context alone is sufficient to elicit sensitive disclosures that single turn evaluations would never surface.

Abstract

LLM Agent Security

Explore similar work

Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems

MNC: Scope-Bound Semantic Declassification for Private LLM-Agent Communication

Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control